Generic ZSync update fails with "Connection refused" despite the control file being directly reachable

## Generic ZSync update fails with "Connection refused" despite the control file being directly reachable

### Description

I am unable to update the Krita 5.0.0 AppImage using `appimageupdate` 0.4.0.

The issue is 100% reproducible with the Krita 5.0.0 AppImage. Interestingly, checking for an update works correctly and takes about one second, but attempting the actual update hangs for approximately 4–5 minutes and eventually fails with a connection error while fetching the ZSync control file.

The same ZSync URL can be fetched successfully and immediately using `curl`, over both IPv4 and IPv6.

### Environment

* `appimageupdate`: 0.4.0
* OS: Fedora Linux 44
* Desktop: KDE Plasma / Wayland
* Architecture: x86_64
* AppImage: Krita 5.0.0
* Network: native IPv4 + IPv6
* IPv6 is working correctly; the router provides a native IPv6 `/56` prefix.

### AppImage update metadata

Running:

```text
appimageupdate --describe ~/Applications/krita-5.0.0-x86_64.appimage
```

reports:

```text
/home/roy/Applications/krita-5.0.0-x86_64.appimage:
  AppImage type: Type 2
  Update info: zsync|https://download.kde.org/stable/krita/updates/Krita-Stable-x86_64.appimage.zsync
  Update info type: Generic ZSync (zsync)
  ZSync URL: https://download.kde.org/stable/krita/updates/Krita-Stable-x86_64.appimage.zsync
  Assembled URL: https://download.kde.org/stable/krita/updates/Krita-Stable-x86_64.appimage.zsync
```

### Update check works

Running:

```text
appimageupdate --check-for-update ~/Applications/krita-5.0.0-x86_64.appimage
```

returns almost immediately:

```text
krita-5.0.0-x86_64.app... Update available
```

The command exits with status `1`, as expected for an available update.

Typical execution time is approximately:

```text
0.13s user 0.01s system 10% cpu 1.250 total
```

### Actual update fails

Running the updater directly:

```text
appimageupdate --overwrite --remove-old ~/Applications/krita-5.0.0-x86_64.appimage
```

causes it to sit at:

```text
Resolving update URLs...
```

for approximately 4 minutes 30 seconds.

It then fails with:

```text
Failed to update 1 AppImage(s):
  krita-5.0.0-x86_64.appimage: Zsync error: Failed to fetch control file: HTTP error: io: Connection refused
```

The total execution time is typically around:

```text
0.00s user 0.00s system 0% cpu 4:29.80 total
```

The AppImage remains unchanged at Krita 5.0.0.

### The control file itself is reachable

The URL reported by `--describe` can be fetched successfully with `curl`.

IPv4:

```text
curl -4 -IL 'https://download.kde.org/stable/krita/updates/Krita-Stable-x86_64.appimage.zsync'
```

succeeds.

IPv6:

```text
curl -6 -IL 'https://download.kde.org/stable/krita/updates/Krita-Stable-x86_64.appimage.zsync'
```

also succeeds.

The request receives a normal HTTP 302 redirect from KDE's Mirrorbits infrastructure and ultimately returns HTTP 200.

For example, the final response includes:

```text
HTTP/2 200
server: nginx
content-type: application/octet-stream
content-length: 652082
last-modified: Sun, 26 Jul 2026 12:35:16 GMT
accept-ranges: bytes
```

I also tested the redirected mirror directly, over both IPv4 and IPv6, and those requests succeed as well.

### Additional context

Initially I suspected an IPv6 connectivity problem because the updater reported:

```text
io: Network unreachable
```

However, I discovered that IPv6 had simply been disabled on my router (it's a new one, I guess it comes with IPv6 disabled). After enabling native IPv6, the router obtained a global IPv6 /56 prefix and IPv6 connectivity from the machine was confirmed.

The current failure is different: both IPv4 and IPv6 `curl` requests to the control-file URL work correctly, while `appimageupdate` 0.4.0 still fails during the actual update.

This therefore appears to be specific to the networking/request path used by the ZSync update operation rather than a general connectivity problem.

### Reproduction

This should be reproducible with:

1. Obtain the Krita 5.0.0 x86_64 AppImage.
2. Run:

   ```text
   appimageupdate --describe krita-5.0.0-x86_64.appimage
   ```
3. Confirm the Generic ZSync metadata:

   ```text
   zsync|https://download.kde.org/stable/krita/updates/Krita-Stable-x86_64.appimage.zsync
   ```
4. Run:

   ```text
   appimageupdate --check-for-update krita-5.0.0-x86_64.appimage
   ```

   This reports that an update is available.
5. Run:

   ```text
   appimageupdate --overwrite --remove-old krita-5.0.0-x86_64.appimage
   ```
6. The updater remains at `Resolving update URLs...` for roughly 4–5 minutes and eventually reports:

   ```text
   Zsync error: Failed to fetch control file: HTTP error: io: Connection refused
   ```

### Expected behavior

The updater should successfully retrieve the ZSync control file and proceed with the delta update, since the control-file URL is directly reachable from the same machine over both IPv4 and IPv6.

### Actual behavior

The update check succeeds, but the actual update cannot retrieve the control file and eventually fails with `Connection refused` after several minutes.

If useful, I can provide the original Krita 5.0.0 AppImage for reproduction (should it isn't available from krita anymore), along with any additional diagnostic output or network traces needed.


Navigation Menu

Uh oh!

Generic ZSync update fails with "Connection refused" despite the control file being directly reachable #34